Overview

overview

7

Static

static

PK2Om5k-ju...FQ.exe

windows7_x64

7

PK2Om5k-ju...FQ.exe

windows10_x64

3

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    11-07-2020 07:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PK2Om5k-july2020-RFQ.exe

  • Size

    655KB

  • MD5

    7a95ab7ac86df9e25dba3f7a4004b137

  • SHA1

    0809fc325af70e81bfdbf73579abfb9752224471

  • SHA256

    8444fb3b56e5ce9643786f9663e364d9a3bb926efe3395485053450950fe8df8

  • SHA512

    ec1f5df66b39d670720b13f49ab1dd03f79df619e7fc838a84e04d576ea24d2a7a4a7e88965d3001258d5abbe0016e557d9f4815d193ae851a61385b1f522f5c

Score
7/10
evasiontrojan

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of SendNotifyMessage
    • Checks whether UAC is enabled
    • Suspicious use of FindShellTrayWindow
    PID:1228
    • C:\Users\Admin\AppData\Local\Temp\PK2Om5k-july2020-RFQ.exe
      "C:\Users\Admin\AppData\Local\Temp\PK2Om5k-july2020-RFQ.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      PID:1464
      • C:\Users\Admin\AppData\Local\Temp\PK2Om5k-july2020-RFQ.exe
        "{path}"
        3⤵
        • Suspicious use of WriteProcessMemory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: MapViewOfSection
        PID:740
        • C:\Windows\SysWOW64\NETSTAT.EXE
          "C:\Windows\SysWOW64\NETSTAT.EXE"
          4⤵
          • Suspicious use of WriteProcessMemory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious behavior: MapViewOfSection
          PID:1028
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\PK2Om5k-july2020-RFQ.exe"
            5⤵
            • Deletes itself
            PID:1520

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/740-2-0x0000000000400000-0x000000000042A000-memory.dmp
    Filesize

    168KB

    Download
  • memory/740-3-0x000000000041B680-mapping.dmp
    Download
  • memory/1028-5-0x0000000000000000-mapping.dmp
    Download
  • memory/1028-6-0x00000000000A0000-0x00000000000A9000-memory.dmp
    Filesize

    36KB

    Download
  • memory/1028-8-0x0000000003130000-0x0000000003263000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/1228-4-0x0000000006A80000-0x0000000006C1F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1464-1-0x0000000000000000-0x0000000000000000-disk.dmp
    Download
  • memory/1520-7-0x0000000000000000-mapping.dmp
    Download